# Generated from the package source. Do not edit.
"""Make a DKE store key on your own machine, from Python.

    import os
    from pathlib import Path
    from dke.keys import mint

    made = mint("notes", label="nightly", level="read",
                token=os.environ["DKEKEY_TOKEN"],
                open_with=Path("notes.key").read_text())
    fd = os.open("nightly.key", os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
    with os.fdopen(fd, "w") as out:
        out.write(made.key + "
")

This is what the `dkekey` tool does, as a library. The key is made here, from
the operating system's random source. To add it to a store, this module opens
the store with a key that already opens it, wraps the store's data key under
the new key, and hands the account service two things: the new key's SHA-256
hash and that wrap. The key itself is never sent, and neither is the key that
opened the store, nor a password: a password derives, here, the proof the
account checks and the key the account's customer key is kept under, exactly
as the dashboard does.

AN EXTRA, NOT THE CORE. The `keys` extra adds one dependency, `cryptography`,
and this module uses it for one thing: AES-GCM, which the standard library
does not have. HKDF, PBKDF2, SHA-256 and the random source
are the standard library's. The rest of the package stays dependency-free:
`import dke` never reaches this module, which the test suite asserts by
reading the import graph and again by running it.

A NETWORK MODULE, LIKE `dke.client`. It talks to the account service, it is
reached by nothing the producing half imports, and importing it is the grant.

SIGNING IN, one of two ways:

  * `email=` and `password=`, as a person signs in to the dashboard. With
    nothing else given, the store is opened with the account's customer key,
    which the password opens.
  * `token=`, an account token made in the dashboard. A token can only add
    keys to stores that exist, up to the level it was made with, and opens no
    store by itself: give `open_with=` as well.

`open_with=` is a key that already opens the store: one of its store keys
(`dke_s_...`) or the account's customer key (`dke_c_...`).

FAILURES. A wrong argument raises `ValueError` before anything is sent.
Anything the account service refuses, or a key that does not open the store,
raises `MintError`, a `dke.client.DkeError`, whose message says what to do."""

import base64
import hashlib
import hmac
import json
import re
import secrets
import urllib.error
import urllib.parse
import urllib.request
from dataclasses import dataclass, field
from typing import Any
from dke import __version__
from dke.client import DkeError
__all__ = ['mint', 'MintedKey', 'MintError', 'LEVELS', 'KEY_FORMAT', 'DEFAULT_API']
DEFAULT_API: ...
KEY_FORMAT: ...
LEVELS: ...

class MintError(DkeError):
    """The key was not made: refused by the account service, or the store
    would not open with what was given. `status` is the account service's HTTP
    status and `code` its refusal code, when it answered with them."""
    def __init__(self, message: str, *, status: int | None=None, code: str | None=None) -> None:
        ...

@dataclass(frozen=True)
class MintedKey:
    """A key that was made. `key` is the key itself, shown nowhere else: keep
    it. It is left out of the repr, so a log line that prints this object
    never carries it."""
    key: str = field(repr=False)
    id: str
    store: str
    level: str
    label: str

def mint(store: str, *, label: str, level: str='read', email: str | None=None, password: str | None=None, token: str | None=None, open_with: str | None=None, api: str=DEFAULT_API, timeout: float=60.0) -> MintedKey:
    """Make a key for `store`, listed in the dashboard as `label`, able to do
    what `level` names. See the module documentation for signing in."""
    ...